If a secret in your Next.js project has a NEXT_PUBLIC_ prefix, it is in the JavaScript you send to every visitor. Nothing warns you, and the site works normally. You can check right now. From your project root:

npm run build grep -rEl 'sk[A-Za-z0-9._-]{40,}|AKIA[0-9A-Z]{16}|BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY' .next/static

Enter fullscreen mode

Exit fullscreen mode

No output means none of those patterns turned up. A file name means you have something to look at. The patterns cover Sanity tokens, AWS keys and private keys, so for anything else, search for the first few characters of the real value.

We ran into this ourselves. A Next.js and Sanity project read its token from NEXT_PUBLIC_SANITY_API_READ_TOKEN , a name picked to match the project ID and dataset next to it. Those two are public. The token isn't, and it ended up in three files under .next/static .

Why this happens

Next.js replaces every process.env.NEXT_PUBLIC_* reference with its value at build time.…